PT-2007-6282 · X Script · X-Script Guestbook

Publicado 2007-10-03 · Atualizado 2018-10-15 · CVE-2007-5189

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions x-script GuestBook version 1.3a

Description The issue concerns SQL injection vulnerabilities in the mes add.php file of x-script GuestBook. When magic quotes gpc is disabled, remote attackers can execute arbitrary SQL commands by manipulating the name, email, icq, and website parameters.

Recommendations For x-script GuestBook version 1.3a, consider disabling the mes add.php file or restricting access to it until a patch is available. As a temporary workaround, enable magic quotes gpc to prevent SQL injection attacks. Avoid using the name, email, icq, and website parameters in the affected file until the issue is resolved.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2007-5189

Produtos afetados

X-Script Guestbook

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-5189 · Nota de Segurança
• http://securityreason.com/securityalert/3186 · Nota
• http://vupen.com/english/advisories/2007/3347 · Nota
• http://securityfocus.com/archive/1/481209/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36895 · Nota
• http://securityfocus.com/bid/25890 · Nota